win64 from win32

muta...@gmail.com

unread,

Dec 9, 2022, 6:22:19 AM12/9/22

to

I have 32-bit Cygwin and I tried using a slightly
modified gcc 3.2.3 built with TARGET_64BIT
and binutils 2.22 targeting x86_64-unknown-pe
and was wondering whether a purely 32-bit
toolchain could create a 64-bit executable.

I didn't have high hopes, but I was surprised to
find that I seem to have a valid 64-bit executable.

I have been through most, but not all the bytes,
checking against the documentation, and it looks
correct to me.

I created a simple program that just did a "return 5".

My real intention is to make it an EFI bootloader,
but I have tried it as a normal Windows 64-bit
program, and Windows rejects it, saying that it
can't run on my Windows 10 64-bit system.

Can anyone see anything wrong with the below?

Here's the entire code:

000400 B8050000 00C3

C:\devel\test>type efistart.s
.file "efistart.c"
.text
.align 4
.globl _efimain
_efimain:
LFB1:
movl $5, %eax
ret
LFE1:

Thanks. Paul.

000000 4D5A9000 03000000 04000000 FFFF0000 MZ..............
000010 B8000000 00000000 40000000 00000000 ........@.......
000020 00000000 00000000 00000000 00000000 ................
000030 00000000 00000000 00000000 80000000 ................
000040 0E1FBA0E 00B409CD 21B8014C CD215468 ........!..L.!Th
000050 69732070 726F6772 616D2063 616E6E6F is program canno
000060 74206265 2072756E 20696E20 444F5320 t be run in DOS
000070 6D6F6465 2E0D0D0A 24000000 00000000 mode....$.......
000080 50450000 64860300 E0079363 00000000 PE..d......c....
000090 00000000 F0002E22 0B020216 00020000 ......."........
0000A0 00040000 00000000 00100000 00100000 ................
0000B0 00000010 00000000 00100000 00020000 ................
0000C0 04000000 00000000 05000200 00000000 ................
0000D0 00400000 00040000 F8360000 03000000 .@.......6......
0000E0 00002000 00000000 00100000 00000000 .. .............
0000F0 00001000 00000000 00100000 00000000 ................
000100 00000000 10000000 00200000 47000000 ......... ..G...
000110 00300000 14000000 00000000 00000000 .0..............
000120 00000000 00000000 00000000 00000000 ................
000130 00000000 00000000 00000000 00000000 ................
000140 00000000 00000000 00000000 00000000 ................
000150 00000000 00000000 00000000 00000000 ................
000160 00000000 00000000 00000000 00000000 ................
000170 00000000 00000000 00000000 00000000 ................
000180 00000000 00000000 2E746578 74000000 .........text...
000190 30000000 00100000 00020000 00040000 0...............
0001A0 00000000 00000000 00000000 20005060 ............ .P`
0001B0 2E656461 74610000 47000000 00200000 .edata..G.... ..
0001C0 00020000 00060000 00000000 00000000 ................
0001D0 00000000 40003040 2E696461 74610000 ....@.0@.idata..
0001E0 14000000 00300000 00020000 00080000 .....0..........
0001F0 00000000 00000000 00000000 400030C0 ............@.0.
000200 00000000 00000000 00000000 00000000 ................
000210 00000000 00000000 00000000 00000000 ................
000220 00000000 00000000 00000000 00000000 ................
000230 00000000 00000000 00000000 00000000 ................
000240 00000000 00000000 00000000 00000000 ................
000250 00000000 00000000 00000000 00000000 ................
000260 00000000 00000000 00000000 00000000 ................
000270 00000000 00000000 00000000 00000000 ................
000280 00000000 00000000 00000000 00000000 ................
000290 00000000 00000000 00000000 00000000 ................
0002A0 00000000 00000000 00000000 00000000 ................
0002B0 00000000 00000000 00000000 00000000 ................
0002C0 00000000 00000000 00000000 00000000 ................
0002D0 00000000 00000000 00000000 00000000 ................
0002E0 00000000 00000000 00000000 00000000 ................
0002F0 00000000 00000000 00000000 00000000 ................
000300 00000000 00000000 00000000 00000000 ................
000310 00000000 00000000 00000000 00000000 ................
000320 00000000 00000000 00000000 00000000 ................
000330 00000000 00000000 00000000 00000000 ................
000340 00000000 00000000 00000000 00000000 ................
000350 00000000 00000000 00000000 00000000 ................
000360 00000000 00000000 00000000 00000000 ................
000370 00000000 00000000 00000000 00000000 ................
000380 00000000 00000000 00000000 00000000 ................
000390 00000000 00000000 00000000 00000000 ................
0003A0 00000000 00000000 00000000 00000000 ................
0003B0 00000000 00000000 00000000 00000000 ................
0003C0 00000000 00000000 00000000 00000000 ................
0003D0 00000000 00000000 00000000 00000000 ................
0003E0 00000000 00000000 00000000 00000000 ................
0003F0 00000000 00000000 00000000 00000000 ................
000400 B8050000 00C39090 90909090 90909090 ................
000410 FFFFFFFF FFFFFFFF 00000000 00000000 ................
000420 FFFFFFFF FFFFFFFF 00000000 00000000 ................
000430 00000000 00000000 00000000 00000000 ................
000440 00000000 00000000 00000000 00000000 ................
000450 00000000 00000000 00000000 00000000 ................
000460 00000000 00000000 00000000 00000000 ................
000470 00000000 00000000 00000000 00000000 ................
000480 00000000 00000000 00000000 00000000 ................
000490 00000000 00000000 00000000 00000000 ................
0004A0 00000000 00000000 00000000 00000000 ................
0004B0 00000000 00000000 00000000 00000000 ................
0004C0 00000000 00000000 00000000 00000000 ................
0004D0 00000000 00000000 00000000 00000000 ................
0004E0 00000000 00000000 00000000 00000000 ................
0004F0 00000000 00000000 00000000 00000000 ................
000500 00000000 00000000 00000000 00000000 ................
000510 00000000 00000000 00000000 00000000 ................
000520 00000000 00000000 00000000 00000000 ................
000530 00000000 00000000 00000000 00000000 ................
000540 00000000 00000000 00000000 00000000 ................
000550 00000000 00000000 00000000 00000000 ................
000560 00000000 00000000 00000000 00000000 ................
000570 00000000 00000000 00000000 00000000 ................
000580 00000000 00000000 00000000 00000000 ................
000590 00000000 00000000 00000000 00000000 ................
0005A0 00000000 00000000 00000000 00000000 ................
0005B0 00000000 00000000 00000000 00000000 ................
0005C0 00000000 00000000 00000000 00000000 ................
0005D0 00000000 00000000 00000000 00000000 ................
0005E0 00000000 00000000 00000000 00000000 ................
0005F0 00000000 00000000 00000000 00000000 ................
000600 00000000 E0079363 00000000 32200000 .......c....2 ..
000610 01000000 01000000 01000000 28200000 ............( ..
000620 2C200000 30200000 00100000 3E200000 , ..0 ......> ..
000630 00007064 70746573 742E6578 65005F65 ..pdptest.exe._e
000640 66696D61 696E0000 00000000 00000000 fimain..........
000650 00000000 00000000 00000000 00000000 ................
000660 00000000 00000000 00000000 00000000 ................
000670 00000000 00000000 00000000 00000000 ................
000680 00000000 00000000 00000000 00000000 ................
000690 00000000 00000000 00000000 00000000 ................
0006A0 00000000 00000000 00000000 00000000 ................
0006B0 00000000 00000000 00000000 00000000 ................
0006C0 00000000 00000000 00000000 00000000 ................
0006D0 00000000 00000000 00000000 00000000 ................
0006E0 00000000 00000000 00000000 00000000 ................
0006F0 00000000 00000000 00000000 00000000 ................
000700 00000000 00000000 00000000 00000000 ................
000710 00000000 00000000 00000000 00000000 ................
000720 00000000 00000000 00000000 00000000 ................
000730 00000000 00000000 00000000 00000000 ................
000740 00000000 00000000 00000000 00000000 ................
000750 00000000 00000000 00000000 00000000 ................
000760 00000000 00000000 00000000 00000000 ................
000770 00000000 00000000 00000000 00000000 ................
000780 00000000 00000000 00000000 00000000 ................
000790 00000000 00000000 00000000 00000000 ................
0007A0 00000000 00000000 00000000 00000000 ................
0007B0 00000000 00000000 00000000 00000000 ................
0007C0 00000000 00000000 00000000 00000000 ................
0007D0 00000000 00000000 00000000 00000000 ................
0007E0 00000000 00000000 00000000 00000000 ................
0007F0 00000000 00000000 00000000 00000000 ................
000800 00000000 00000000 00000000 00000000 ................
000810 00000000 00000000 00000000 00000000 ................
000820 00000000 00000000 00000000 00000000 ................
000830 00000000 00000000 00000000 00000000 ................
000840 00000000 00000000 00000000 00000000 ................
000850 00000000 00000000 00000000 00000000 ................
000860 00000000 00000000 00000000 00000000 ................
000870 00000000 00000000 00000000 00000000 ................
000880 00000000 00000000 00000000 00000000 ................
000890 00000000 00000000 00000000 00000000 ................
0008A0 00000000 00000000 00000000 00000000 ................
0008B0 00000000 00000000 00000000 00000000 ................
0008C0 00000000 00000000 00000000 00000000 ................
0008D0 00000000 00000000 00000000 00000000 ................
0008E0 00000000 00000000 00000000 00000000 ................
0008F0 00000000 00000000 00000000 00000000 ................
000900 00000000 00000000 00000000 00000000 ................
000910 00000000 00000000 00000000 00000000 ................
000920 00000000 00000000 00000000 00000000 ................
000930 00000000 00000000 00000000 00000000 ................
000940 00000000 00000000 00000000 00000000 ................
000950 00000000 00000000 00000000 00000000 ................
000960 00000000 00000000 00000000 00000000 ................
000970 00000000 00000000 00000000 00000000 ................
000980 00000000 00000000 00000000 00000000 ................
000990 00000000 00000000 00000000 00000000 ................
0009A0 00000000 00000000 00000000 00000000 ................
0009B0 00000000 00000000 00000000 00000000 ................
0009C0 00000000 00000000 00000000 00000000 ................
0009D0 00000000 00000000 00000000 00000000 ................
0009E0 00000000 00000000 00000000 00000000 ................
0009F0 00000000 00000000 00000000 00000000 ................

Apd

unread,

Dec 9, 2022, 11:38:08 AM12/9/22

to

"<muta...@gmail.com>" wrote:

> Can anyone see anything wrong with the below?

[...]

> 000000 4D5A9000 03000000 04000000 FFFF0000 MZ..............
> 000010 B8000000 00000000 40000000 00000000 ........@.......
> 000020 00000000 00000000 00000000 00000000 ................
> 000030 00000000 00000000 00000000 80000000 ................
> 000040 0E1FBA0E 00B409CD 21B8014C CD215468 ........!..L.!Th
> 000050 69732070 726F6772 616D2063 616E6E6F is program canno
> 000060 74206265 2072756E 20696E20 444F5320 t be run in DOS
> 000070 6D6F6465 2E0D0D0A 24000000 00000000 mode....$.......
> 000080 50450000 64860300 E0079363 00000000 PE..d......c....
> 000090 00000000 F0002E22 0B020216 00020000 ......."........

-----------------------^^^^

In the "characteristics" it's marked as a DLL.

Change 2E22 to 2E02 (shown as little endian here) to make it an exe.

muta...@gmail.com

unread,

Dec 9, 2022, 2:08:14 PM12/9/22

to

On Saturday, December 10, 2022 at 12:38:08 AM UTC+8, Apd wrote:

> > 000090 00000000 F0002E22 0B020216 00020000 ......."........
> -----------------------^^^^
>
> In the "characteristics" it's marked as a DLL.
>
> Change 2E22 to 2E02 (shown as little endian here) to make it an exe.

Thanks a lot for that - that worked!

I forgot that I had added the -dll in an attempt to get
it to work as an EFI, because I saw examples of that
online.

So that means I'm still stuck as far as making this an
EFI module (I already do zap pdptest.exe 0xdc 0x0a).

However, I noticed something else of interest.

With the 64-bit version, I get this:

C:\devel\test>testit

C:\devel\test>pdptest

C:\devel\test>if errorlevel 6 goto end

C:\devel\test>echo hi there
hi there
C:\devel\test>

C:\devel\test>testit

C:\devel\test>pdptest

C:\devel\test>if errorlevel 5 goto end

C:\devel\test>

C:\devel\test>type testit.bat
pdptest
if errorlevel 5 goto end
echo hi there
:end

With the 32-bit version I get:

C:\devel\pdos\pdpclib>testit

C:\devel\pdos\pdpclib>pdptest

C:\devel\pdos\pdpclib>if errorlevel 5 goto end

C:\devel\pdos\pdpclib>

C:\devel\pdos\pdpclib>testit

C:\devel\pdos\pdpclib>pdptest

C:\devel\pdos\pdpclib>if errorlevel 4 goto end

C:\devel\pdos\pdpclib>

C:\devel\pdos\pdpclib>type testit.bat
pdptest
if errorlevel 4 goto end
echo hi there
:end

ie equality, 5, behaves differently.

BFN. Paul.

muta...@gmail.com

unread,

Dec 9, 2022, 2:30:52 PM12/9/22

to

That previous errorlevel test was Win 10 64-bit BTW.

Anyway, here is what I was really trying to get work - a loop.

C:\devel\test>type efistart.s
.file "efistart.c"
.text
.align 4
.globl _efimain
_efimain:
LFB1:

.align 4
L2:
jmp L2
LFE1:

000400 EBFE9090 90909090 90909090 90909090 ................

As a Win64 executable it does in fact loop.

But as an EFI app it just returns immediately without error.
At least under Oracle Virtualbox. On real hardware I get an
error about no OS, but I have no experience on UEFI on real
hardware so I don't know if I'm doing something wrong.

The file is called EFI\BOOT\BOOTX64.EFI

It is zapped to subsystem 10:

0000D0 00400000 00040000 8F610000 0A000000 .@.......a......

Any ideas?

Thanks. Paul.

000000 4D5A9000 03000000 04000000 FFFF0000 MZ..............
000010 B8000000 00000000 40000000 00000000 ........@.......
000020 00000000 00000000 00000000 00000000 ................
000030 00000000 00000000 00000000 80000000 ................
000040 0E1FBA0E 00B409CD 21B8014C CD215468 ........!..L.!Th
000050 69732070 726F6772 616D2063 616E6E6F is program canno
000060 74206265 2072756E 20696E20 444F5320 t be run in DOS
000070 6D6F6465 2E0D0D0A 24000000 00000000 mode....$.......

000080 50450000 64860300 61899363 00000000 PE..d...a..c....
000090 00000000 F0002E02 0B020216 00020000 ................

0000A0 00040000 00000000 00100000 00100000 ................

0000B0 00004000 00000000 00100000 00020000 ..@.............

0000C0 04000000 00000000 05000200 00000000 ................

0000D0 00400000 00040000 8F610000 0A000000 .@.......a......

0000E0 00002000 00000000 00100000 00000000 .. .............
0000F0 00001000 00000000 00100000 00000000 ................
000100 00000000 10000000 00200000 47000000 ......... ..G...
000110 00300000 14000000 00000000 00000000 .0..............
000120 00000000 00000000 00000000 00000000 ................
000130 00000000 00000000 00000000 00000000 ................
000140 00000000 00000000 00000000 00000000 ................
000150 00000000 00000000 00000000 00000000 ................
000160 00000000 00000000 00000000 00000000 ................
000170 00000000 00000000 00000000 00000000 ................
000180 00000000 00000000 2E746578 74000000 .........text...
000190 30000000 00100000 00020000 00040000 0...............
0001A0 00000000 00000000 00000000 20005060 ............ .P`
0001B0 2E656461 74610000 47000000 00200000 .edata..G.... ..
0001C0 00020000 00060000 00000000 00000000 ................
0001D0 00000000 40003040 2E696461 74610000 ....@.0@.idata..
0001E0 14000000 00300000 00020000 00080000 .....0..........
0001F0 00000000 00000000 00000000 400030C0 ............@.0.

000200 00000000 00000000 00000000 00000000 ................
000210 00000000 00000000 00000000 00000000 ................
000220 00000000 00000000 00000000 00000000 ................
000230 00000000 00000000 00000000 00000000 ................
000240 00000000 00000000 00000000 00000000 ................
000250 00000000 00000000 00000000 00000000 ................
000260 00000000 00000000 00000000 00000000 ................
000270 00000000 00000000 00000000 00000000 ................
000280 00000000 00000000 00000000 00000000 ................
000290 00000000 00000000 00000000 00000000 ................
0002A0 00000000 00000000 00000000 00000000 ................
0002B0 00000000 00000000 00000000 00000000 ................
0002C0 00000000 00000000 00000000 00000000 ................
0002D0 00000000 00000000 00000000 00000000 ................
0002E0 00000000 00000000 00000000 00000000 ................
0002F0 00000000 00000000 00000000 00000000 ................
000300 00000000 00000000 00000000 00000000 ................
000310 00000000 00000000 00000000 00000000 ................
000320 00000000 00000000 00000000 00000000 ................
000330 00000000 00000000 00000000 00000000 ................
000340 00000000 00000000 00000000 00000000 ................
000350 00000000 00000000 00000000 00000000 ................
000360 00000000 00000000 00000000 00000000 ................
000370 00000000 00000000 00000000 00000000 ................
000380 00000000 00000000 00000000 00000000 ................
000390 00000000 00000000 00000000 00000000 ................
0003A0 00000000 00000000 00000000 00000000 ................
0003B0 00000000 00000000 00000000 00000000 ................
0003C0 00000000 00000000 00000000 00000000 ................
0003D0 00000000 00000000 00000000 00000000 ................
0003E0 00000000 00000000 00000000 00000000 ................
0003F0 00000000 00000000 00000000 00000000 ................
000400 EBFE9090 90909090 90909090 90909090 ................

000410 FFFFFFFF FFFFFFFF 00000000 00000000 ................
000420 FFFFFFFF FFFFFFFF 00000000 00000000 ................

000430 00000000 00000000 00000000 00000000 ................
000440 00000000 00000000 00000000 00000000 ................
000450 00000000 00000000 00000000 00000000 ................
000460 00000000 00000000 00000000 00000000 ................
000470 00000000 00000000 00000000 00000000 ................
000480 00000000 00000000 00000000 00000000 ................
000490 00000000 00000000 00000000 00000000 ................
0004A0 00000000 00000000 00000000 00000000 ................
0004B0 00000000 00000000 00000000 00000000 ................
0004C0 00000000 00000000 00000000 00000000 ................
0004D0 00000000 00000000 00000000 00000000 ................
0004E0 00000000 00000000 00000000 00000000 ................
0004F0 00000000 00000000 00000000 00000000 ................
000500 00000000 00000000 00000000 00000000 ................
000510 00000000 00000000 00000000 00000000 ................
000520 00000000 00000000 00000000 00000000 ................
000530 00000000 00000000 00000000 00000000 ................
000540 00000000 00000000 00000000 00000000 ................
000550 00000000 00000000 00000000 00000000 ................
000560 00000000 00000000 00000000 00000000 ................
000570 00000000 00000000 00000000 00000000 ................
000580 00000000 00000000 00000000 00000000 ................
000590 00000000 00000000 00000000 00000000 ................
0005A0 00000000 00000000 00000000 00000000 ................
0005B0 00000000 00000000 00000000 00000000 ................
0005C0 00000000 00000000 00000000 00000000 ................
0005D0 00000000 00000000 00000000 00000000 ................
0005E0 00000000 00000000 00000000 00000000 ................
0005F0 00000000 00000000 00000000 00000000 ................
000600 00000000 61899363 00000000 32200000 ....a..c....2 ..

000610 01000000 01000000 01000000 28200000 ............( ..
000620 2C200000 30200000 00100000 3E200000 , ..0 ......> ..
000630 00007064 70746573 742E6578 65005F65 ..pdptest.exe._e
000640 66696D61 696E0000 00000000 00000000 fimain..........

000650 00000000 00000000 00000000 00000000 ................
000660 00000000 00000000 00000000 00000000 ................
000670 00000000 00000000 00000000 00000000 ................
000680 00000000 00000000 00000000 00000000 ................
000690 00000000 00000000 00000000 00000000 ................
0006A0 00000000 00000000 00000000 00000000 ................
0006B0 00000000 00000000 00000000 00000000 ................
0006C0 00000000 00000000 00000000 00000000 ................
0006D0 00000000 00000000 00000000 00000000 ................
0006E0 00000000 00000000 00000000 00000000 ................
0006F0 00000000 00000000 00000000 00000000 ................
000700 00000000 00000000 00000000 00000000 ................
000710 00000000 00000000 00000000 00000000 ................
000720 00000000 00000000 00000000 00000000 ................
000730 00000000 00000000 00000000 00000000 ................
000740 00000000 00000000 00000000 00000000 ................
000750 00000000 00000000 00000000 00000000 ................
000760 00000000 00000000 00000000 00000000 ................
000770 00000000 00000000 00000000 00000000 ................
000780 00000000 00000000 00000000 00000000 ................
000790 00000000 00000000 00000000 00000000 ................
0007A0 00000000 00000000 00000000 00000000 ................
0007B0 00000000 00000000 00000000 00000000 ................
0007C0 00000000 00000000 00000000 00000000 ................
0007D0 00000000 00000000 00000000 00000000 ................
0007E0 00000000 00000000 00000000 00000000 ................
0007F0 00000000 00000000 00000000 00000000 ................
000800 00000000 00000000 00000000 00000000 ................
000810 00000000 00000000 00000000 00000000 ................
000820 00000000 00000000 00000000 00000000 ................
000830 00000000 00000000 00000000 00000000 ................
000840 00000000 00000000 00000000 00000000 ................
000850 00000000 00000000 00000000 00000000 ................
000860 00000000 00000000 00000000 00000000 ................
000870 00000000 00000000 00000000 00000000 ................
000880 00000000 00000000 00000000 00000000 ................
000890 00000000 00000000 00000000 00000000 ................
0008A0 00000000 00000000 00000000 00000000 ................
0008B0 00000000 00000000 00000000 00000000 ................
0008C0 00000000 00000000 00000000 00000000 ................
0008D0 00000000 00000000 00000000 00000000 ................
0008E0 00000000 00000000 00000000 00000000 ................
0008F0 00000000 00000000 00000000 00000000 ................
000900 00000000 00000000 00000000 00000000 ................
000910 00000000 00000000 00000000 00000000 ................
000920 00000000 00000000 00000000 00000000 ................
000930 00000000 00000000 00000000 00000000 ................
000940 00000000 00000000 00000000 00000000 ................
000950 00000000 00000000 00000000 00000000 ................
000960 00000000 00000000 00000000 00000000 ................
000970 00000000 00000000 00000000 00000000 ................
000980 00000000 00000000 00000000 00000000 ................
000990 00000000 00000000 00000000 00000000 ................
0009A0 00000000 00000000 00000000 00000000 ................
0009B0 00000000 00000000 00000000 00000000 ................
0009C0 00000000 00000000 00000000 00000000 ................
0009D0 00000000 00000000 00000000 00000000 ................
0009E0 00000000 00000000 00000000 00000000 ................
0009F0 00000000 00000000 00000000 00000000 ................

Apd

unread,

Dec 9, 2022, 4:27:40 PM12/9/22

to

"<muta...@gmail.com>" wrote:
[...]

> As a Win64 executable it does in fact loop.
>
> But as an EFI app it just returns immediately without error.
> At least under Oracle Virtualbox.

It's an infinite loop so that suggests it's not being run at all.

> On real hardware I get an error about no OS,

Your at a level before the main OS is loaded. Is it complaining about
that or does the EFI need to be running its own mini OS first?

> but I have no experience on UEFI on real
> hardware so I don't know if I'm doing something wrong.
>
> The file is called EFI\BOOT\BOOTX64.EFI
>
> It is zapped to subsystem 10:
>
> 0000D0 00400000 00040000 8F610000 0A000000 .@.......a......

Which indeed marks it as an EFI application.

> Any ideas?

I've also no experience with (U)EFI code but I notice there can be
other settings for that value:

EFI boot driver
EFI runtime driver
EFI ROM driver

You said you wanted a boot loader which you may need before you can
run any EFI app (I don't know!). I also don't know if the major and
minor subsystem version fields are relevant (they are for a normal
Win executable).

Also, what purpose does the exported name "_efimain" serve? Does there
need to be any code there?

muta...@gmail.com

unread,

Dec 9, 2022, 4:58:09 PM12/9/22

to

On Saturday, December 10, 2022 at 5:27:40 AM UTC+8, Apd wrote:

> "<muta...@gmail.com>" wrote:
> [...]
> > As a Win64 executable it does in fact loop.
> >
> > But as an EFI app it just returns immediately without error.
> > At least under Oracle Virtualbox.

> It's an infinite loop so that suggests it's not being run at all.

Right. But if I just type in "fff" or something, I get
command not found (in UEFI shell), so it can
clearly see the EFI.

> > On real hardware I get an error about no OS,

> Your at a level before the main OS is loaded. Is it complaining about
> that or does the EFI need to be running its own mini OS first?

My EFI *is* destined to be the main OS. A 64-bit
version of PDOS (http://pdos.org).

I do not have any idea what is happening.

> I've also no experience with (U)EFI code but I notice there can be
> other settings for that value:
>
> EFI boot driver
> EFI runtime driver
> EFI ROM driver

I have experience with 32-bit, and x'0a', EFI application,
is what someone else told me, and it works.

> You said you wanted a boot loader which you may need before you can
> run any EFI app (I don't know!).

This *is* the boot loader. The firmware should directly
find this. But if you can get an EFI shell (some computers
have this, but I'm using Oracle virtualbox to give me that),
you can operate it like MSDOS except the executables are
called .efi and you can cd to the location and type their
name.

> I also don't know if the major and
> minor subsystem version fields are relevant (they are for a normal
> Win executable).

Yeah, I had noticed it was 5.2 in 64-bit and 4.0 in 32-bit
and I tried zapping the 5.2 to 4.0, but that didn't change
anything.

> Also, what purpose does the exported name "_efimain" serve? Does there
> need to be any code there?

From looking at the web, it looks like you can have any
name for the entry point.

But yes, the 32-bit version has just "efimain", even though
the assembler has "_efimain" - I don't know why the
underscore is being stripped.

But I assume that that wouldn't be an issue because the
name was flexible, and I expected the system to look at
the entry point address, not exported symbols.

What do you mean by "does there need to be any code there"?
All the code (ie the loop) is at the _efimain location.

Thanks. Paul.

Apd

unread,

Dec 9, 2022, 6:45:58 PM12/9/22

to

"<muta...@gmail.com>" wrote:
> On Saturday, December 10, 2022 at 5:27:40 AM UTC+8, Apd wrote:
>> It's an infinite loop so that suggests it's not being run at all.
>
> Right. But if I just type in "fff" or something, I get
> command not found (in UEFI shell), so it can
> clearly see the EFI.

Sounds like you need some way of debugging this.

>> You're at a level before the main OS is loaded. Is it complaining

>> about that or does the EFI need to be running its own mini OS first?
>
> My EFI *is* destined to be the main OS. A 64-bit
> version of PDOS (http://pdos.org).

I didn't know that was possible.

> I do not have any idea what is happening.

Me neither. All I can do is make suggestions.

>> You said you wanted a boot loader which you may need before you can
>> run any EFI app (I don't know!).
>
> This *is* the boot loader. The firmware should directly
> find this. But if you can get an EFI shell (some computers
> have this, but I'm using Oracle virtualbox to give me that),
> you can operate it like MSDOS except the executables are
> called .efi and you can cd to the location and type their
> name.

Ok. It's clear you know more about EFI use than I do.

>> Also, what purpose does the exported name "_efimain" serve? Does there
>> need to be any code there?
>
> From looking at the web, it looks like you can have any
> name for the entry point.

Maybe it doesn't need that export at all.

> But yes, the 32-bit version has just "efimain", even though
> the assembler has "_efimain" - I don't know why the
> underscore is being stripped.
>
> But I assume that that wouldn't be an issue because the
> name was flexible, and I expected the system to look at
> the entry point address, not exported symbols.

Yes, I would expect that for a normal exe.

> What do you mean by "does there need to be any code there"?
> All the code (ie the loop) is at the _efimain location.

I know. I wondered if that export might point to some specific code
for EFI exes but I see now that it does point to the same virtual
address as the entry point that's in the optional header.

Another thing is I notice the checksum field is filled in your last
hex dump and it's invalid (it was ok for the original DLL you made).
Do EFI apps require this? I know it's needed for kernel mode
executables but isn't for user mode ones.

muta...@gmail.com

unread,

Dec 9, 2022, 9:38:50 PM12/9/22

to

On Saturday, December 10, 2022 at 7:45:58 AM UTC+8, Apd wrote:

> > Right. But if I just type in "fff" or something, I get
> > command not found (in UEFI shell), so it can
> > clearly see the EFI.

> Sounds like you need some way of debugging this.

I asked someone to trim this:

https://github.com/utshina/uefi-simple

down to a simple for (;;) ; and give me the binary. They
gave me a binary, but it wasn't trimmed, so not the trivial
code I wanted to see.

I'll wait a bit longer to see if they trim it for me.

> >> You're at a level before the main OS is loaded. Is it complaining
> >> about that or does the EFI need to be running its own mini OS first?
> >
> > My EFI *is* destined to be the main OS. A 64-bit
> > version of PDOS (http://pdos.org).

> I didn't know that was possible.

What did you think the boot sequence was on a modern 64-bit machine?

> > From looking at the web, it looks like you can have any
> > name for the entry point.

> Maybe it doesn't need that export at all.

The export probably isn't needed, but it happens automatically
with at least that global function that I need to name as the
entry point.

> Another thing is I notice the checksum field is filled in your last
> hex dump and it's invalid (it was ok for the original DLL you made).
> Do EFI apps require this? I know it's needed for kernel mode
> executables but isn't for user mode ones.

This gave me a lot of hope, but alas, it still didn't solve the
problem.

I made this change:

C:\devel\binutils-2.22\ld>diff -c ei386pep.bak ei386pep.c
*** ei386pep.bak 1970-01-01 08:00:00.000000000 +0800
--- ei386pep.c 1970-01-01 08:00:00.000000000 +0800
***************
*** 495,500 ****
--- 495,501 ----
{ "console", 3 },
{ "posix", 7 },
{ "wince", 9 },
+ { "efi", 10 },
{ "xbox", 14 },
{ NULL, 0 }
};

C:\devel\binutils-2.22\ld>

So that I no longer had to zap the subsystem from 3 to A.

Is the subsystem number included in the checksum?

How did you determine the checksum was wrong?

Given that kernel executables require the checksum to be
correct, can I get my "return (5);" executable to be a kernel
program so that I can at least see if Windows agrees that
the checksum is correct?

Then I could zap from 3 to A, then zap the checksum by 7,
if the subsystem is included.

Finally, can you tell me if this executable has the correct
checksum?

Thanks. Paul.

000000 4D5A9000 03000000 04000000 FFFF0000 MZ..............
000010 B8000000 00000000 40000000 00000000 ........@.......
000020 00000000 00000000 00000000 00000000 ................
000030 00000000 00000000 00000000 80000000 ................
000040 0E1FBA0E 00B409CD 21B8014C CD215468 ........!..L.!Th
000050 69732070 726F6772 616D2063 616E6E6F is program canno
000060 74206265 2072756E 20696E20 444F5320 t be run in DOS
000070 6D6F6465 2E0D0D0A 24000000 00000000 mode....$.......

000080 50450000 64860300 37ED9363 00000000 PE..d...7..c....

000090 00000000 F0002E02 0B020216 00020000 ................
0000A0 00040000 00000000 00100000 00100000 ................
0000B0 00004000 00000000 00100000 00020000 ..@.............
0000C0 04000000 00000000 05000200 00000000 ................

0000D0 00400000 00040000 43290000 0A000000 .@......C)......

000600 00000000 37ED9363 00000000 32200000 ....7..c....2 ..

Apd

unread,

Dec 10, 2022, 6:09:10 AM12/10/22

to

"<muta...@gmail.com>" wrote:
> On Saturday, December 10, 2022 at 7:45:58 AM UTC+8, Apd wrote:
>>> My EFI *is* destined to be the main OS. A 64-bit
>>> version of PDOS (http://pdos.org).
>
>> I didn't know that was possible.
>
> What did you think the boot sequence was on a modern 64-bit machine?

I mean that I didn't know you could use PDOS to get an EFI shell and
that PDOS could run Win PE files.

> Is the subsystem number included in the checksum?

Yes.

> How did you determine the checksum was wrong?

I have "Dependency Walker" which highlights the checksum in red if
it's invalid.

> Given that kernel executables require the checksum to be
> correct, can I get my "return (5);" executable to be a kernel
> program so that I can at least see if Windows agrees that
> the checksum is correct?

I don't know. Kernel mode programs are usually drivers loaded by the
OS. Yours isn't built like that.

> Then I could zap from 3 to A, then zap the checksum by 7,
> if the subsystem is included.
>
> Finally, can you tell me if this executable has the correct
> checksum?

Yes.

Another thought. Are you sure the EFI is 64bit? I have an old Mac with
a 32bit EFI and a 64bit processor.

muta...@gmail.com

unread,

Dec 10, 2022, 6:49:17 AM12/10/22

to

I don't have access to my computer at the moment so
typing is difficult.

It's possible that virtualbox is giving
me 32 bit UEFI only. I'll try to test that theory.

I didn't mean that pdos will give a UEFI
shell. But instead of a pdos supplied mbr
boot sector etc I will have a pdos supplied
Bootx64.efi.

Using pdos generic this will give a pdos shell
and it will most likely run 64 bit a.out executables.
I don't know if win64 executables will
be technically possible.

I'll think about that.

Same deal, I'm not sure UEFI executables could
be supported or make sense.

Pdos generic has its own API. Basically c90.

Thanks for confirming the checksum.

muta...@gmail.com

unread,

Dec 10, 2022, 10:34:17 AM12/10/22

to

On Saturday, December 10, 2022 at 7:09:10 PM UTC+8, Apd wrote:

> Another thought. Are you sure the EFI is 64bit? I have an old Mac with
> a 32bit EFI and a 64bit processor.

This theory seems to be correct.

I tried running 2 other "hello world" EFI binaries from
other people and they exhibit the same behavior
under Oracle Virtualbox.

I'm pursuing that now, thanks.

BFN. Paul.

muta...@gmail.com

unread,

Dec 11, 2022, 4:28:28 AM12/11/22

to

Ok, here is the latest.

I am unable to get 64-bit executables from others, or
my own to run on Oracle Virtualbox. Only 32-bit works.

On real hardware, neither 32-bit nor 64-bit works. I tried
using GPT instead of MBR, but that didn't help either,
although diskpart didn't give me an option to mark a
partition as "active" so I don't know if that was a factor.

However, I have 64-bit working on qemu. I can make it
start and freeze, or start and exit.

What I can't do is display anything.

One thing I noticed was that gcc 3.2.3 (and 3.4.6) only seem
to support the Unix calling convention, not Windows:

https://en.wikipedia.org/wiki/X86_calling_conventions#x86-64_calling_conventions

But I changed gcc 3.2.3 to generate Microsoft, to an
extent.

I then manually edited the assembler to do another thing
required - provide 32 bytes of stack space.

I am now stuck again. Here is the assembler:

LFB1:
pushq %rcx
LCFI0:
movb $88, 4(%rsp)
movb $0, 5(%rsp)
movb $0, 6(%rsp)
movb $0, 7(%rsp)
movq 60(%rdx), %rax
movq %rax, %rcx
leaq 4(%rsp), %rdx
pushq %r11
pushq %r11
pushq %r11
pushq %r11
call *8(%rax)
popq %r11
popq %r11
popq %r11
popq %r11
movl $5, %eax
popq %rdx
LCFI1:
ret

It looks correct to me, and has no dependencies on data etc
being relocated correctly.

But it hangs in the call, without displaying 'X'.

If I comment out the call, all is fine, I can either hang or exit,
my choice.

Any ideas?

C code below, but remember I have manually edited the assembler.

Thanks. Paul.

typedef struct {
void *junk1;
unsigned long (*print_func)(void *x, void *y);
} EFI_SIMPLE_TEXT;

typedef struct {
char junk1[24];
void *junk2;
int junk3;
void *junk4;
void *junk5;
void *stdout_handle;
EFI_SIMPLE_TEXT *simple;
} EFI_SYSTEM;

static EFI_SYSTEM *system;

static unsigned long print_string(char *str);

unsigned long efimain(void *junk, EFI_SYSTEM *sys)
{
char zzz[4];

/* system = sys; */
zzz[0] = 'X';
zzz[1] = '\0';
zzz[2] = '\0';
zzz[3] = '\0';
sys->simple->print_func(sys->simple, zzz);
return (5);
for (;;) ;
print_string("hello, world\n");

print_string("looping now\n");

for (;;) ;
return (0);
}

static unsigned long print_string(char *str)
{
static char onechar[4];
int x = 0;

while (str[x] != '\0')
{
if (str[x] == '\n')
{
onechar[0] = '\r';
system->simple->print_func(system->simple, onechar);
}
onechar[0] = str[x];
system->simple->print_func(system->simple, onechar);
x++;
}
return (x);
}

# This builds EFI executables for the x86_64

CC=gccw64
AR=arw64
LD=ldw64
AS=asw64
COPTS=-S -O2 -mno-red-zone -fpack-struct -D__WIN32__ -D__NOBIVA__ -I.

pdptest.exe: efistart.o
$(LD) -s -subsystem efi -e _efimain -nostdlib -o pdptest.exe efistart.o
# $(LD) -s -e _efimain -nostdlib -o pdptest.exe efistart.o
copy pdptest.exe pdptest.old
# subsystem efi
# zap pdptest.exe 0xdc 0x0a

.c.o:
$(CC) $(COPTS) -o $*.s $<
copy new.s efistart.s
$(AS) -a=list.txt -o $*.o $*.s
echo rm -f $*.s

.asm.o:
$(AS) -o $@ $<

muta...@gmail.com

unread,

Dec 11, 2022, 6:31:20 AM12/11/22

to

Here is the executable BTW.

The code is a bit longer than the assembler because there
is some unused code after the ret that I didn't show.

This is the only bit that matters:

000400 51C64424 0458C644 240500C6 44240600 Q.D$.X.D$...D$..
000410 C6442407 00488B42 3C4889C1 488D5424 .D$..H.B<H..H.T$
000420 04415341 53415341 53FF5008 415B415B .ASASASAS.P.A[A[
000430 415B415B B8050000 005AC390

BFN. Paul.

000000 4D5A9000 03000000 04000000 FFFF0000 MZ..............
000010 B8000000 00000000 40000000 00000000 ........@.......
000020 00000000 00000000 00000000 00000000 ................
000030 00000000 00000000 00000000 80000000 ................
000040 0E1FBA0E 00B409CD 21B8014C CD215468 ........!..L.!Th
000050 69732070 726F6772 616D2063 616E6E6F is program canno
000060 74206265 2072756E 20696E20 444F5320 t be run in DOS
000070 6D6F6465 2E0D0D0A 24000000 00000000 mode....$.......

000080 50450000 64860500 FE979563 00000000 PE..d......c....

000090 00000000 F0002E02 0B020216 00020000 ................

0000A0 00060000 00020000 00100000 00100000 ................

0000B0 00004000 00000000 00100000 00020000 ..@.............
0000C0 04000000 00000000 05000200 00000000 ................

0000D0 00600000 00040000 893E0000 0A000000 .`.......>......

0000E0 00002000 00000000 00100000 00000000 .. .............
0000F0 00001000 00000000 00100000 00000000 ................

000100 00000000 10000000 00300000 47000000 .........0..G...
000110 00400000 14000000 00000000 00000000 .@..............

000120 00000000 00000000 00000000 00000000 ................

000130 00500000 0C000000 00000000 00000000 .P..............

000140 00000000 00000000 00000000 00000000 ................
000150 00000000 00000000 00000000 00000000 ................
000160 00000000 00000000 00000000 00000000 ................
000170 00000000 00000000 00000000 00000000 ................
000180 00000000 00000000 2E746578 74000000 .........text...

000190 D0000000 00100000 00020000 00040000 ................

0001A0 00000000 00000000 00000000 20005060 ............ .P`

0001B0 2E627373 00000000 20000000 00200000 .bss.... .... ..
0001C0 00000000 00000000 00000000 00000000 ................
0001D0 00000000 800050C0 2E656461 74610000 ......P..edata..
0001E0 47000000 00300000 00020000 00060000 G....0..........
0001F0 00000000 00000000 00000000 40003040 ............@.0@
000200 2E696461 74610000 14000000 00400000 .idata.......@..
000210 00020000 00080000 00000000 00000000 ................
000220 00000000 400030C0 2E72656C 6F630000 ....@.0..reloc..
000230 0C000000 00500000 00020000 000A0000 .....P..........
000240 00000000 00000000 00000000 40003042 ............@.0B

000400 51C64424 0458C644 240500C6 44240600 Q.D$.X.D$...D$..
000410 C6442407 00488B42 3C4889C1 488D5424 .D$..H.B<H..H.T$
000420 04415341 53415341 53FF5008 415B415B .ASASASAS.P.A[A[
000430 415B415B B8050000 005AC390 41545553 A[A[.....Z..ATUS
000440 4531E480 39004889 CD743731 DB0F1F00 E1..9.H..t71....
000450 8A042B3C 0A743588 05A30F00 00488B05 ..+<.t5......H..
000460 AC0F0000 488B403C 41FFC4BA 00204000 ....H.@<A.... @.
000470 4889C1FF 50084489 E0803C28 004889C3 H...P.D...<(.H..
000480 75CE5B5D 4963C441 5CC36690 C6056D0F u.[]Ic.A\.f...m.
000490 00000D48 8B05760F 0000488B 403CBA00 ...H..v...H.@<..
0004A0 20400048 89C1FF50 088A042B EBA99090 @.H...P...+....
0004B0 FFFFFFFF FFFFFFFF 00000000 00000000 ................
0004C0 FFFFFFFF FFFFFFFF 00000000 00000000 ................

0004D0 00000000 00000000 00000000 00000000 ................
0004E0 00000000 00000000 00000000 00000000 ................
0004F0 00000000 00000000 00000000 00000000 ................
000500 00000000 00000000 00000000 00000000 ................
000510 00000000 00000000 00000000 00000000 ................
000520 00000000 00000000 00000000 00000000 ................
000530 00000000 00000000 00000000 00000000 ................
000540 00000000 00000000 00000000 00000000 ................
000550 00000000 00000000 00000000 00000000 ................
000560 00000000 00000000 00000000 00000000 ................
000570 00000000 00000000 00000000 00000000 ................
000580 00000000 00000000 00000000 00000000 ................
000590 00000000 00000000 00000000 00000000 ................
0005A0 00000000 00000000 00000000 00000000 ................
0005B0 00000000 00000000 00000000 00000000 ................
0005C0 00000000 00000000 00000000 00000000 ................
0005D0 00000000 00000000 00000000 00000000 ................
0005E0 00000000 00000000 00000000 00000000 ................
0005F0 00000000 00000000 00000000 00000000 ................

000600 00000000 FE979563 00000000 32300000 .......c....20..
000610 01000000 01000000 01000000 28300000 ............(0..
000620 2C300000 30300000 00100000 3E300000 ,0..00......>0..

000A00 00100000 0C000000 6C309F30 00000000 ........l0.0....
000A10 00000000 00000000 00000000 00000000 ................
000A20 00000000 00000000 00000000 00000000 ................
000A30 00000000 00000000 00000000 00000000 ................
000A40 00000000 00000000 00000000 00000000 ................
000A50 00000000 00000000 00000000 00000000 ................
000A60 00000000 00000000 00000000 00000000 ................
000A70 00000000 00000000 00000000 00000000 ................
000A80 00000000 00000000 00000000 00000000 ................
000A90 00000000 00000000 00000000 00000000 ................
000AA0 00000000 00000000 00000000 00000000 ................
000AB0 00000000 00000000 00000000 00000000 ................
000AC0 00000000 00000000 00000000 00000000 ................
000AD0 00000000 00000000 00000000 00000000 ................
000AE0 00000000 00000000 00000000 00000000 ................
000AF0 00000000 00000000 00000000 00000000 ................
000B00 00000000 00000000 00000000 00000000 ................
000B10 00000000 00000000 00000000 00000000 ................
000B20 00000000 00000000 00000000 00000000 ................
000B30 00000000 00000000 00000000 00000000 ................
000B40 00000000 00000000 00000000 00000000 ................
000B50 00000000 00000000 00000000 00000000 ................
000B60 00000000 00000000 00000000 00000000 ................
000B70 00000000 00000000 00000000 00000000 ................
000B80 00000000 00000000 00000000 00000000 ................
000B90 00000000 00000000 00000000 00000000 ................
000BA0 00000000 00000000 00000000 00000000 ................
000BB0 00000000 00000000 00000000 00000000 ................
000BC0 00000000 00000000 00000000 00000000 ................
000BD0 00000000 00000000 00000000 00000000 ................
000BE0 00000000 00000000 00000000 00000000 ................
000BF0 00000000 00000000 00000000 00000000 ................

Apd

unread,

Dec 11, 2022, 8:12:32 AM12/11/22

to

"<muta...@gmail.com>" wrote:
[...]

> LFB1:
> pushq %rcx
> LCFI0:
> movb $88, 4(%rsp)
> movb $0, 5(%rsp)
> movb $0, 6(%rsp)
> movb $0, 7(%rsp)
> movq 60(%rdx), %rax
> movq %rax, %rcx
> leaq 4(%rsp), %rdx
> pushq %r11
> pushq %r11
> pushq %r11
> pushq %r11
> call *8(%rax)

Presumably this call does the display. How? What do you expect RAX to
contain? I notice you have no imported library (dll) to call from so,
either you need one or it's doing a direct syscall of some kind into
the OS.

> sys->simple->print_func(sys->simple, zzz);

So you need to check this routine to make sure your exe can find and
call it correctly, either from an import library or as some offset
into system memory where the routine lives, as perhaps you are trying
to do.

muta...@gmail.com

unread,

Dec 11, 2022, 10:12:25 AM12/11/22

to

On Sunday, December 11, 2022 at 9:12:32 PM UTC+8, Apd wrote:

> > movq 60(%rdx), %rax
> > movq %rax, %rcx
> > leaq 4(%rsp), %rdx
> > pushq %r11
> > pushq %r11
> > pushq %r11
> > pushq %r11
> > call *8(%rax)

> Presumably this call does the display. How? What do you expect RAX to
> contain?

Here is someone else's code that calls the exact
same function:

https://github.com/utshina/uefi-simple/blob/master/main.c

Just under a different name. But same offset - 60.

> I notice you have no imported library (dll) to call from so,
> either you need one or it's doing a direct syscall of some kind into
> the OS.

UEFI is basically a massive OS with syscalls, in the firmware.

But it doesn't use either DLLs or interrupts, it is instead
similar to the Amiga. The Amiga hardcodes the address
4, and then has a huge series of pointers from that
address.

UEFI instead gives you the long list of pointers via a pointer
to a struct that is placed "on the stack" (for 64-bit at least,
because the number of parameters is only 2, registers are
used instead of the actual stack) as per Microsoft convention.

> > sys->simple->print_func(sys->simple, zzz);

> So you need to check this routine to make sure your exe can find and
> call it correctly, either from an import library or as some offset
> into system memory where the routine lives, as perhaps you are trying
> to do.

Yes, the latter is exactly what I am trying to do, and I've
looked at the assembler a million times but can't see
anything wrong with it.

If this was PDOS, I would simply put debug into the OS
to see what is happening. But to do the equivalent here I would
need to figure out how to build the UEFI that comes with Qemu.

BFN. Paul.

muta...@gmail.com

unread,

Feb 23, 2023, 4:06:19 AMFeb 23

to

Someone else restarted work on this, and told me that
they needed to remove the -fpacked_struct.

It seems that 32-bit requires packing while 64-bit shouldn't be.

I haven't definitively proven this myself as I am not currently
working on it.

BFN. Paul.

Reply all

Reply to author

Forward